If you have a few “special” PCs in your business, the ones attached to a piece of equipment, a kiosk, a line-of-business app, a POS back office, there’s a decent chance one of them is quietly running Windows 10 2016 LTSB.

That matters because Windows 10 Enterprise 2016 LTSB and Windows 10 IoT Enterprise 2016 LTSB reach end of support on October 13, 2026. After that date, you’re in the world of exceptions, compensating controls, and awkward questions from auditors and insurers.

What actually changes after October 13, 2026

End of support is not a “your PC stops turning on” moment. It is a “the safety net is gone” moment.

Here’s what that means in plain terms:

  • No more security updates. New vulnerabilities keep being discovered. Without vendor security patches, the risk on that device grows over time, even if nobody “touches” it.
  • Harder compliance conversations. Many frameworks and customer security questionnaires boil down to one thing: can you prove you keep systems supported and patched? An end-of-support OS makes that hard to answer cleanly.
  • Cyber insurance friction. Insurers increasingly ask about patching and unsupported systems during underwriting and renewals. Unsupported endpoints are the sort of detail that can trigger exclusions, higher premiums, or required remediation.

Even if the device is “just a kiosk”, it is still a computer on your network. If it can talk to other systems, it can become someone else’s problem in a hurry.

How to find Windows 10 2016 LTSB (without guessing)

The biggest mistake we see is assuming you only have “normal” Windows 10. LTSB and IoT builds often show up on:

  • front-desk kiosks and check-in stations
  • manufacturing and warehouse terminals
  • medical or dental imaging workstations
  • POS and digital signage
  • “this can never change” vendor-managed PCs

A practical way to hunt is to use what you already have, then fall back to a quick on-device check.

  • Your endpoint management tool. If you use Microsoft Intune, you can review device inventory and OS details per device, and you can also use app inventory style reporting to help identify what is installed where (helpful when these devices have a telltale vendor agent or kiosk software).
  • Your security tool’s device inventory. If you use Microsoft Defender for Endpoint, the device inventory is designed to be the authoritative list of devices it can see, and it includes OS information you can filter and export.
  • A simple on-device check. On a suspected machine, open Start, type winver, and press Enter. Look for wording that includes “2016 LTSB” or “LTSC”, and note the version/build. Windows 10 2016 LTSB is commonly associated with the Windows 10 version 1607 generation.

As you find them, capture three details right away: device name, physical location, and what business process it supports. That turns a scary-sounding technical problem into a manageable operations plan.

Why these devices become a compliance and insurance problem

Most security programmes are built around patching. It is one of the few controls that consistently reduces real-world risk.

When an OS is out of support, you cannot honestly say, “We patch our operating systems,” because you cannot patch that one anymore. That is the moment where:

  • a customer asks for proof of patch cadence
  • an auditor asks for your exception register and compensating controls
  • an insurer asks whether any systems are end-of-life or unsupported

This is also where “but it’s behind the firewall” stops being a satisfying answer. Firewalls matter, but they do not replace vendor security updates on the device itself.

Your realistic options: upgrade, replace, isolate, or ESU

There is no single right answer. The right answer depends on whether the device is a normal workstation, a dedicated-purpose kiosk, or something tied to specialised hardware.

  • Upgrade (best when it’s a normal PC). If the hardware is still healthy and the application is compatible, moving to a supported Windows release is usually the cleanest fix. It restores normal patching, normal security baselines, and fewer exceptions.
  • Replace (best when the device is old or “touchy”). Many 2016-era devices are due for retirement anyway. Replacement is often cheaper than months of troubleshooting, and it reduces downtime risk. For kiosks and shared stations, replacement can also be a chance to standardise the setup.
  • Isolate (best when you truly cannot change it yet). Sometimes you have a vendor dependency, a piece of equipment that cannot be upgraded quickly, or a business process that would stop. In those cases, isolation is about reducing blast radius:
  • Network segmentation. Put the device on its own VLAN or restricted subnet.
  • Tight inbound and outbound rules. Allow only the exact traffic it needs (for example, to one application server), and block the rest.
  • No interactive email and web browsing. Kiosk means kiosk. Do not let it become a general-use PC.
  • Extra monitoring. If you must accept risk, you should be able to see it.
  • Buy ESU as a short bridge (best when you need time, not a permanent workaround). Microsoft offers Extended Security Updates (ESU) for Windows 10 Enterprise 2016 LTSB and Windows 10 IoT Enterprise 2016 LTSB to extend security updates past October 13, 2026. ESU is meant to buy you time to migrate, not to justify staying put indefinitely.

A helpful way to decide is to ask one question: “If this device is compromised, what else could it reach?” The more it can reach, the more you should push toward upgrade or replacement instead of long-term isolation.

A simple action plan you can run this week

You do not need a big project plan to get control of this. You need a short, calm sequence.

  • Step 1: Inventory. Find every Windows 10 2016 LTSB and IoT Enterprise 2016 LTSB device, and confirm what it does.
  • Step 2: Classify. For each device, label it: upgrade, replace, isolate, or ESU.
  • Step 3: Put dates on it. If you are using ESU, set an internal deadline to be off ESU well before it ends. “Temporary” needs a calendar.
  • Step 4: Document the exception. If you keep an end-of-support system for any period, write down why, what controls you added, and who approved it. This is what your future self, your auditor, and your insurer will ask for.

Want a second set of eyes?

These LTSB systems are rarely the only “hidden legacy” in a growing business, they are just the ones with a clear deadline. If you would like help finding these devices, choosing the right path for each one, and putting the isolation or upgrade plan in place, the Flexnet Networks team can help.

Sources